Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    android_x64
  • resource
    android-x64-20240624-en
  • resource tags

    androidarch:x64arch:x86image:android-x64-20240624-enlocale:en-usos:android-10-x64system
  • submitted
    03/01/2025, 22:23

General

  • Target
    JaffaCakes118_7185ff85ec43f1a42fe89725720975fb.apk
  • Size 5.0MB
  • Sample250103-2a7dkawphz
  • SHA256 de032609bda6ab2da5ccf34923eccf0024f2342795a220f5e7ce8c14ebc87e34
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Signatures

  • SMSFactory

    SMSFactory is an Android SMS trojan malware first seen in Jun 2022.

  • Smsfactory family
  • Checks if the Android device is rooted. 1 TTPs 3 IoCs
  • Acquires the wake lock 1 IoCs
  • Queries information about active data network 1 TTPs 2 IoCs
  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
  • Schedules tasks to execute at a specified time 1 TTPs 2 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
  • Checks memory information 2 TTPs 1 IoCs

Processes

  • com.halfbrick.fruitninjafree.hack
    1⤵
    • Checks if the Android device is rooted.
    • Acquires the wake lock
    • Queries information about active data network
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    • Checks memory information
    PID:4970
  • com.halfbrick.fruitninjafree.hack:Metrica
    1⤵
    • Checks if the Android device is rooted.
    • Queries information about active data network
    • Queries information about the current Wi-Fi connection
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Schedules tasks to execute at a specified time
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5016

Network

        MITRE ATT&CK Mobile v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        OneSignal.db

        • Path /data/data/com.halfbrick.fruitninjafree.hack/databases/OneSignal.db
        • Size 52KB
        • SHA256 c17b0ff6f351266dfc375282c9ee02b8263348390207cec71835d7e0956419e3
        • MD5 SHA1 SHA512 SSDEEP

        OneSignal.db-journal

        • Path /data/data/com.halfbrick.fruitninjafree.hack/databases/OneSignal.db-journal
        • Size 8KB
        • SHA256 2448e040cfadd40e70648bf93ec1513b024b1efc6b1a308abece0f979ef11e89
        • MD5 SHA1 SHA512 SSDEEP

        OneSignal.db-journal

        • Path /data/data/com.halfbrick.fruitninjafree.hack/databases/OneSignal.db-journal
        • Size 512B
        • SHA256 6066e123b578fabb804fb404da3ea21c5614bf7bde1d28aea9779a8eb46bfe8a
        • MD5 SHA1 SHA512

        OneSignal.db-journal

        • Path /data/data/com.halfbrick.fruitninjafree.hack/databases/OneSignal.db-journal
        • Size 44KB
        • SHA256 ce2d49083cae493866334d8a1fded5dd2098997f08e79dc35fdba61bbf02b2c6
        • MD5 SHA1 SHA512 SSDEEP

        Mint-lastsavedfile

        • Path /data/data/com.halfbrick.fruitninjafree.hack/files/Mint-lastsavedfile
        • Size 12KB
        • SHA256 58a57b2bb7d46284d191843757d8fc1854981395c9007c6d38e5b9e0c5ae0060
        • MD5 SHA1 SHA512 SSDEEP

        MintSavedData-1-1735943042393.json

        • Path /data/data/com.halfbrick.fruitninjafree.hack/files/MintSavedData-1-1735943042393.json
        • Size 8KB
        • SHA256 9359ba652db12b54e3decd6d8246ef3e480148912df5adea85e5187ee22ac950
        • MD5 SHA1 SHA512 SSDEEP

        credentials.dat

        • Path /data/data/com.halfbrick.fruitninjafree.hack/files/credentials.dat
        • Size 226B
        • SHA256 7c374388f57b4ca2638a9fa783797bd22dc9daf6e15dd74e5d1ca0808f8fdc1c
        • MD5 SHA1 SHA512

        androidx.work.workdb

        • Path /data/data/com.halfbrick.fruitninjafree.hack/no_backup/androidx.work.workdb
        • Size 12KB
        • SHA256 d267d0760b757fd41ca3fb4b47cd14c6a4859f16b90d1c855507361c96222b7c
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-journal

        • Path /data/data/com.halfbrick.fruitninjafree.hack/no_backup/androidx.work.workdb-journal
        • Size 12KB
        • SHA256 9bb6a95d0612bdb1b964e780268294de267a0db5900cdf2b776a0a6423684a6d
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-shm

        • Path /data/data/com.halfbrick.fruitninjafree.hack/no_backup/androidx.work.workdb-shm
        • Size 48KB
        • SHA256 3bd3988a079788bf90d62147932d169a9b8613c4a309b4b3e213b6d82d7e31ca
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.halfbrick.fruitninjafree.hack/no_backup/androidx.work.workdb-wal
        • Size 16KB
        • SHA256 181c9f1375a12fe8b2df7d17ae442ab08151ddbbd0d0e8610568d8863629cbd6
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.halfbrick.fruitninjafree.hack/no_backup/androidx.work.workdb-wal
        • Size 108KB
        • SHA256 aabaf32b262db0da504b25abb3f5bdc6922d1188116f5f8a3f6285d1ceb8531e
        • MD5 SHA1 SHA512 SSDEEP

        androidx.work.workdb-wal

        • Path /data/data/com.halfbrick.fruitninjafree.hack/no_backup/androidx.work.workdb-wal
        • Size 197KB
        • SHA256 7926a5868ff49baf96777b0a63ebc81beb75b3859083fe3707f6df4efee9b589
        • MD5 SHA1 SHA512 SSDEEP

        com.google.InstanceId.properties

        • Path /data/data/com.halfbrick.fruitninjafree.hack/no_backup/com.google.InstanceId.properties
        • Size 2KB
        • SHA256 55bf45e7759e1e7c78feb534495e56dd8de88ae892f98fc2683e872cb9b27ca2
        • MD5 SHA1 SHA512

        credentials.dat

        • Path /data/data/com.halfbrick.fruitninjafree.hack/no_backup/credentials.dat
        • Size 20KB
        • SHA256 9af2cb8291435b74aea9de962389cdb4aa7ae89ca8c52dae3635181e14739316
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.halfbrick.fruitninjafree.hack-journal

        • Path /data/data/com.halfbrick.fruitninjafree.hack/no_backup/db_metrica_com.halfbrick.fruitninjafree.hack-journal
        • Size 8KB
        • SHA256 3071e2246f16f046c78390d61988a80a6f18f71b9cda6eae036f734c8fb1c8aa
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.halfbrick.fruitninjafree.hack-journal

        • Path /data/data/com.halfbrick.fruitninjafree.hack/no_backup/db_metrica_com.halfbrick.fruitninjafree.hack-journal
        • Size 12KB
        • SHA256 23b76e8579fc186326f5fe9b288f7d07784de7c7ae5495887641a1856e22ff1e
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.halfbrick.fruitninjafree.hack-journal

        • Path /data/data/com.halfbrick.fruitninjafree.hack/no_backup/db_metrica_com.halfbrick.fruitninjafree.hack-journal
        • Size 269KB
        • SHA256 1be7875b6b85b6f8cad6404a16fed94d247c14cdf3f315f847ade13452adc810
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.halfbrick.fruitninjafree.hack_20799a27-fa80-4b36-b2db-0f8141f24180

        • Path /data/data/com.halfbrick.fruitninjafree.hack/no_backup/db_metrica_com.halfbrick.fruitninjafree.hack_20799a27-fa80-4b36-b2db-0f8141f24180
        • Size 36KB
        • SHA256 c7fa34265ce7a5681bb30d1cec167e2ae8ed86ea7a3a37ecac0f218a35c0e263
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.halfbrick.fruitninjafree.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/data/com.halfbrick.fruitninjafree.hack/no_backup/db_metrica_com.halfbrick.fruitninjafree.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 12KB
        • SHA256 080c2626848a490039f206dfe295d0338adf6105ed9db93dace5efd18e64b379
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.halfbrick.fruitninjafree.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/data/com.halfbrick.fruitninjafree.hack/no_backup/db_metrica_com.halfbrick.fruitninjafree.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 20KB
        • SHA256 ed6565b05061de0993d1cfdde6462ab1be51fcb5e2653a21a6540cc0f646ef3e
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.halfbrick.fruitninjafree.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/data/com.halfbrick.fruitninjafree.hack/no_backup/db_metrica_com.halfbrick.fruitninjafree.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 12KB
        • SHA256 e25c3f9bfd5f16baeca4d954a1a1b191dbde0d5df0451cddf5e64e4a41edefdb
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.halfbrick.fruitninjafree.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/data/com.halfbrick.fruitninjafree.hack/no_backup/db_metrica_com.halfbrick.fruitninjafree.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 8KB
        • SHA256 7d2d6a917687ed35bc2297c6bab110642cb7f8b2b658fd61c8c888be769c7bfb
        • MD5 SHA1 SHA512 SSDEEP

        db_metrica_com.halfbrick.fruitninjafree.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal

        • Path /data/data/com.halfbrick.fruitninjafree.hack/no_backup/db_metrica_com.halfbrick.fruitninjafree.hack_20799a27-fa80-4b36-b2db-0f8141f24180-journal
        • Size 12KB
        • SHA256 5294ce01fa146c21a5af8cc2259d6ef9edec0a96f6d8cc860f07679d4dc42665
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db

        • Path /data/data/com.halfbrick.fruitninjafree.hack/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 a6a865dacbeb03fe850a3e8a9ef7b7f2a49a01b9c766fd314f0945325e9aeb78
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db

        • Path /data/data/com.halfbrick.fruitninjafree.hack/no_backup/metrica_client_data.db
        • Size 116KB
        • SHA256 ddba4ed70eb9b303d4085e348ef2f003e05d825aabac1165fe27c0995526d66c
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db

        • Path /data/data/com.halfbrick.fruitninjafree.hack/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 4564ec31a51694e8349f462d5ada137b3f37b7c42515a7fe34ea8ef33b5063c5
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db

        • Path /data/data/com.halfbrick.fruitninjafree.hack/no_backup/metrica_client_data.db
        • Size 20KB
        • SHA256 28ca53d5e7da2cec66fd23e722b28a86e116f7cf782243a9f9130974ad5fc5bf
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/data/com.halfbrick.fruitninjafree.hack/no_backup/metrica_client_data.db-journal
        • Size 12KB
        • SHA256 ef5cad0facf2fa34898809f607785ced2585c41e46facf31ed41f1a722c27af4
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/data/com.halfbrick.fruitninjafree.hack/no_backup/metrica_client_data.db-journal
        • Size 512B
        • SHA256 921469089f08cc9cf572166f73619c2d419c34fa66ff94f1d4036545dd8b4e34
        • MD5 SHA1 SHA512

        metrica_client_data.db-journal

        • Path /data/data/com.halfbrick.fruitninjafree.hack/no_backup/metrica_client_data.db-journal
        • Size 12KB
        • SHA256 33530548ce75dc6593e4d304c662cf45987527bb03efba23496945f875178135
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/data/com.halfbrick.fruitninjafree.hack/no_backup/metrica_client_data.db-journal
        • Size 12KB
        • SHA256 a84979a3b3a4035967358e3dd363fbb7ef83c154af17ce566dc341ab9b574d0c
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/data/com.halfbrick.fruitninjafree.hack/no_backup/metrica_client_data.db-journal
        • Size 20KB
        • SHA256 5b2e5f20edbb9d568c3efaa503c2fbef56e740b4109072e34fa92c51a5a66662
        • MD5 SHA1 SHA512 SSDEEP

        metrica_client_data.db-journal

        • Path /data/data/com.halfbrick.fruitninjafree.hack/no_backup/metrica_client_data.db-journal
        • Size 12KB
        • SHA256 a4c4abe9cc63dd01fb4ea0e5ba915458b613dbdf891c0c09871859c9d5f3da23
        • MD5 SHA1 SHA512 SSDEEP